isaacroldan · Oct 22, 2026 · Oct 22, 2026
diff --git a/.changeset/api-throttle-backoff.md b/.changeset/api-throttle-backoff.md
diff --git a/.changeset/app-access-shop-scopes.md b/.changeset/app-access-shop-scopes.md
diff --git a/.changeset/app-automation-token-deprecation.md b/.changeset/app-automation-token-deprecation.md
diff --git a/.changeset/app-bulk-cancel-json.md b/.changeset/app-bulk-cancel-json.md
diff --git a/.changeset/app-bulk-execute-json.md b/.changeset/app-bulk-execute-json.md
diff --git a/.changeset/app-bulk-status-json.md b/.changeset/app-bulk-status-json.md
diff --git a/.changeset/app-dev-clean-json.md b/.changeset/app-dev-clean-json.md
diff --git a/.changeset/app-development-fixes.md b/.changeset/app-development-fixes.md
@@ -0,0 +1,6 @@
+---
+'@shopify/app': patch
+'@shopify/cli': patch
+---
+
+Fix lost Shop scopes in `app config link`, legacy Checkout and POS extension migration detection, and UI extension builds with multiple `should_render` targets.
diff --git a/.changeset/app-execute-json.md b/.changeset/app-execute-json.md
diff --git a/.changeset/app-import-custom-data-json.md b/.changeset/app-import-custom-data-json.md
diff --git a/.changeset/app-import-dashboard-extensions-json.md b/.changeset/app-import-dashboard-extensions-json.md
diff --git a/.changeset/app-security-check-improvements.md b/.changeset/app-security-check-improvements.md
@@ -0,0 +1,7 @@
+---
+'@shopify/app': minor
+'@shopify/cli': minor
+'@shopify/cli-kit': minor
+---
+
+Improve `app security check` accuracy and safely scan untrusted repositories; add `--print-instructions`, deprecate `--yes`, and require Git 2.38.0 or later for Git operations.
diff --git a/.changeset/app-security-dependency-automation-repository-root.md b/.changeset/app-security-dependency-automation-repository-root.md
diff --git a/.changeset/app-security-empty-remote-helper.md b/.changeset/app-security-empty-remote-helper.md
diff --git a/.changeset/app-security-flag-descriptions.md b/.changeset/app-security-flag-descriptions.md
diff --git a/.changeset/app-security-git-version.md b/.changeset/app-security-git-version.md
diff --git a/.changeset/app-security-monorepo-lockfiles.md b/.changeset/app-security-monorepo-lockfiles.md
diff --git a/.changeset/app-security-print-instructions.md b/.changeset/app-security-print-instructions.md
diff --git a/.changeset/app-security-react-router-roots.md b/.changeset/app-security-react-router-roots.md
diff --git a/.changeset/app-security-regression-test-nudge.md b/.changeset/app-security-regression-test-nudge.md
diff --git a/.changeset/app-security-shared-namespace-metafield.md b/.changeset/app-security-shared-namespace-metafield.md
diff --git a/.changeset/app-security-static-only.md b/.changeset/app-security-static-only.md
diff --git a/.changeset/app-security-telemetry-disclosure.md b/.changeset/app-security-telemetry-disclosure.md
diff --git a/.changeset/app-security-unresolved-calibration.md b/.changeset/app-security-unresolved-calibration.md
diff --git a/.changeset/app-security-untrusted-git-config.md b/.changeset/app-security-untrusted-git-config.md
diff --git a/.changeset/app-webhook-trigger-json.md b/.changeset/app-webhook-trigger-json.md
diff --git a/.changeset/autocorrect-off-json.md b/.changeset/autocorrect-off-json.md
diff --git a/.changeset/branded-loading-indicator.md b/.changeset/branded-loading-indicator.md
diff --git a/.changeset/bundle-all-should-render-targets.md b/.changeset/bundle-all-should-render-targets.md
diff --git a/.changeset/captured-process-failures.md b/.changeset/captured-process-failures.md
diff --git a/.changeset/clean-themes-stay.md b/.changeset/clean-themes-stay.md
diff --git a/.changeset/cli-json-app-build.md b/.changeset/cli-json-app-build.md
diff --git a/.changeset/cli-reliability-fixes.md b/.changeset/cli-reliability-fixes.md
@@ -0,0 +1,5 @@
+---
+'@shopify/cli-kit': patch
+---
+
+Retry throttled API requests, report process failures correctly, and keep login available when the browser cannot open.
diff --git a/.changeset/cli-security-fixes.md b/.changeset/cli-security-fixes.md
@@ -0,0 +1,7 @@
+---
+'@shopify/cli': patch
+'@shopify/cli-kit': patch
+'@shopify/plugin-cloudflare': patch
+---
+
+Protect webhook secrets in debug output, prevent GraphQL cache reuse across tokens, and harden GraphiQL and local command execution.
diff --git a/.changeset/doc-fetch-json-output.md b/.changeset/doc-fetch-json-output.md
diff --git a/.changeset/doc-search-json-output.md b/.changeset/doc-search-json-output.md
diff --git a/.changeset/empty-automation-token-variable.md b/.changeset/empty-automation-token-variable.md
diff --git a/.changeset/fix-legacy-ui-extension-migration.md b/.changeset/fix-legacy-ui-extension-migration.md
diff --git a/.changeset/function-info-json-contract.md b/.changeset/function-info-json-contract.md
diff --git a/.changeset/function-json.md b/.changeset/function-json.md
diff --git a/.changeset/function-replay-json-contract.md b/.changeset/function-replay-json-contract.md
diff --git a/.changeset/function-run-json-contract.md b/.changeset/function-run-json-contract.md
diff --git a/.changeset/generate-extension-json-output.md b/.changeset/generate-extension-json-output.md
diff --git a/.changeset/graphiql-inline-script-json.md b/.changeset/graphiql-inline-script-json.md
diff --git a/.changeset/graphql-cache-principal-key.md b/.changeset/graphql-cache-principal-key.md
diff --git a/.changeset/headless-open-url-crash.md b/.changeset/headless-open-url-crash.md
diff --git a/.changeset/json-app-channel-config.md b/.changeset/json-app-channel-config.md
diff --git a/.changeset/json-app-deploy.md b/.changeset/json-app-deploy.md
diff --git a/.changeset/json-app-init.md b/.changeset/json-app-init.md
diff --git a/.changeset/json-app-release.md b/.changeset/json-app-release.md
diff --git a/.changeset/json-success-diagnostics.md b/.changeset/json-success-diagnostics.md
diff --git a/.changeset/keypress-accepted-keys.md b/.changeset/keypress-accepted-keys.md
diff --git a/.changeset/liquid-unsafe-render-schema-types.md b/.changeset/liquid-unsafe-render-schema-types.md
diff --git a/.changeset/native-path-containment.md b/.changeset/native-path-containment.md
diff --git a/.changeset/normalize-migration-status-json.md b/.changeset/normalize-migration-status-json.md
diff --git a/.changeset/normalize-migration-submission-json.md b/.changeset/normalize-migration-submission-json.md
diff --git a/.changeset/normalize-migration-subscription-list-json.md b/.changeset/normalize-migration-subscription-list-json.md
diff --git a/.changeset/normalize-migration-unscheduling-json.md b/.changeset/normalize-migration-unscheduling-json.md
diff --git a/.changeset/normalize-subscription-migration-json.md b/.changeset/normalize-subscription-migration-json.md
diff --git a/.changeset/plugin-cloudflare-tar-argv.md b/.changeset/plugin-cloudflare-tar-argv.md
diff --git a/.changeset/preserve-captured-newlines.md b/.changeset/preserve-captured-newlines.md
diff --git a/.changeset/quiet-upgrades-report.md b/.changeset/quiet-upgrades-report.md
diff --git a/.changeset/security-check-usage-examples.md b/.changeset/security-check-usage-examples.md